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WHAT IS CLAIMED IS : 

1 . A method for identifying a flow of data between a source and a destination in a 
networl<, said method comprising the steps of: 

identifying a plurality of packets at a first point and a second point in the 
network; 

comparing a source address of each packet identified at the second point 
with one or more source addresses of packets identified at the first point; and 

if one of the compared source addresses matches, identifying a destination 
address of the corresponding packet identified at the second point, and 
associating the identified destination address and the matching source address to 
a flow between the source and destination. 

2. A method for identifying a flow of data between a source and a destination 
in a network, said method comprising the steps of: 

identifying a plurality of packets at a first point and a second point in the 
network; 

comparing a destination address of each packet identified at the first point 
with one or more destination addresses of packets identified at the second point; 
and 

if one of the compared destination addresses matches, identifying a source 
address of the corresponding packet identified at the first point, and associating 
the identified source address and the matching destination address to a flow 
between the source and destination. 

3. The method of claim 2, wherein the step of identifying a plurality of packets 
at the second point further comprises the steps of: 

generating a compressed address group based on the destination address 
of each packet identified at the second point. 

4. The method of claim 3, wherein generating the compressed address group 
comprises: 

identifying network addresses based on the destination addresses identified 
at the second point; 

classifying each identified network address based on a range of bits in the 
identified network addresses. 
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5. The method of claim 3, wherein generating the compressed address group 
comprises: 

identifying network addresses for the packets identified at the second point; 

if the identified network addresses of two of the packets identified at the 
second point differ by a least significant bit, then generating a compressed 
address by combining the identified network addresses of the two packets. 

6. The method of claim 3, wherein generating the compressed address group 
comprises: 

identifying network addresses based on the destination address identified at 
the second point; 

classifying each identified network address based on a range of bits in the 
identified network addresses; and 

if the identified network addresses of two of the packets identified at the 
second point differ by a least significant bit, then generating a compressed 
address by combining the identified network addresses of the two packets, 
wherein the length of the compressed address is one bit less than the combined 
network addresses. 

7. The method of claim 2, further comprising the step of: 
generating flow information at the first point based on the matched 

destination address and the identified source address. 

8. The method of claim 7, further comprising the step of: 

sending the flow information generated at the first point to the second point. 

9. The method of claim 8, further comprising: 

updating the flow information at the first and second point when a new 
destination address is identified at the second point. 

1 0. The method of claim 8, further comprising the step of: 
updating the flow information at the first and second point when a 

destination address is purged at the second point after a predetermined time-out 
period. 

11. A method for determining a direction of a flow of data between a source and 
a destination in a network, said method comprising the steps of: 
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identifying a plurality of packets at a first point and a second point in the 
network; 

selecting a time-to-live value from the plurality of packets identified at the 
first point and at least one of the plurality of packets identified at the second point; 

comparing a destination address of each packet identified at the first point 
with a destination address of one or more packets identified at the second point; 

if one of the compared destination addresses matches, then identifying a 
source address of the corresponding packet identified at the first point, associating 
the identified source address and the matching destination address to a flow 
between the source and destination, and comparing the time-to-live value of the 
packets identified at the first point and the at least one of the plurality of packets 
identified at the second point corresponding to the flow between the source and 
the destination to determine the direction of the flow between the source and 
destination. 

12. A method for determining a direction of a flow of data between a source and 
a destination in a network, said method comprising the steps of: 

identifying a plurality of packets at a first point and a second point in the 
network; 

selecting a time-to-iive value from at least one of the plurality of packets 
identified at the first point and at least one of the plurality of packets identified at 
the second point; 

comparing a source address of each packet identified at the second point 
with a source address of one or more packets identified at the first point; 

if one of the compared source addresses matches, then identifying a 
destination address of the corresponding packet identified at the second point, and 
associating the identified destination address and the matching source address to 
a flow between the source and destination, and comparing the time-to-live value of 
the packets identified at the first point and the at least one of the plurality of 
packets identified at the second point corresponding to the flow between the 
source and the destination to determine the direction of the flow between the 
source and the destination. 
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1 3. A system for identifying a flow of data between a source and a destination 
in a network, comprising: 

a first processor that identifies a destination address of one or more packets 
flowing through a second point in the network and sends the compressed 
destination addresses to a first point in the network; and 

a second processor that identifies a destination address of a packet flowing 
through the first point, receives the destination addresses from the first processor, 
and generates flow information based on a comparison between the destination 
addresses received from the first processor and the destination addresses of the 
packet identified at the second processor, wherein the flow information identifies 
the flow of packets between the first point and the second point. 

14. A system for identifying a flow of data between a source and a destination 
in a network, comprising: 

a first processor that identifies a source address of one or more packets 
flowing through a first point in the network, and sends the source addresses to a 
second point in the network; and 

a second processor that identifies a source address of a packet flowing 
through the second point, receives compressed source addresses from the first 
processor, and generates flow information based on a comparison between the 
source addresses received from the first processor and the source address of the 
packet identified at the second processor, wherein the flow information identifies 
the flow of packets between the first point and the second point. 



-22- 



